T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:10- Finding
Forced CLI Use and Commercial Output Manipulation
- Content
View full analysis
- Remediation
View remediation
Security audit
Auto Rental
Security checks for vulnerabilities and agentic risk
Overview
This car-rental skill is not proven malicious, but it asks agents to install and run an unpinned global CLI, force booking-link output, and persist raw user travel queries without clear user control.
Install only if you are comfortable with a third-party flyai CLI receiving travel search queries, adding booking links and branding to answers, changing global npm state, and writing local execution logs. A safer version should require explicit install approval, pin and verify the CLI, pass command arguments safely, disclose external data sharing, and avoid storing raw user queries by default.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:36- Finding
Automatic Installation of an Unpinned Global npm Package
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/runbook.md:5- Finding
Shell Injection and Sensitive Data Exposure in Execution Logging
- Content
View full analysis
> .flyai-execution-log.json ``` ### Technical Analysis The runbook requires the log object to contain the raw user query and then demonstrates persistence by embedding the generated JSON directly inside a single-quoted shell command. No JSON encoding, shell escaping, or safe file-writing API is required. If `{generation_log_json}` contains a single quote derived from the raw query, it can terminate the shell's quoted string. Additional shell syntax can then be interpreted as a command. Even when exploitation does not occur, the design writes raw travel requests, command history, timestamps, and execution metadata to a plaintext file without retention limits, access-control requirements, or user consent. Appending independent JSON objects also does not necessarily produce a valid JSON document, which can lead downstream consumers to use unsafe ad hoc parsing. ### Attack Path 1. An attacker submits a travel query containing a single quot ...[truncated 1258 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:70- Finding
User-Controlled Query Values Interpolated into Shell Commands
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
flyai keyword-search --query "租车 成都"
text ## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest description says the skill also supports flight booking, hotel reservation, train tickets, attraction tickets, itinerary planning, visa info, and travel insurance. However, the documented workflow and commands in this file are limited to car-rental searches via
flyai keyword-searchwith rental-focused playbooks only. This is a semantic mismatch between the advertised scope and the behavior described by the skill file.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger "rent a car in {city}" is a common natural-language request that could overlap with ordinary conversation, and the playbook provides no exclusion conditions or narrower invocation context. Because this is a markdown file, ambiguous trigger wording without explicit scope limitations can cause unintended skill activation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The commands use Chinese search terms such as "租车" and "机场租车" while the surrounding playbook is written in English, but the file does not state that the skill is China-specific or that users can choose the query language. This creates a natural-language locale policy concern because the skill implicitly forces a language choice without opt-in or justification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger "car rental at airport" is short, generic, and does not define whether a city, airport code, or other context is required for activation. The absence of specificity or negative examples increases the chance of accidental invocation in everyday travel-related discussion.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The phrase "rent SUV" is generic and could easily match casual user phrasing rather than an intentional skill invocation. The markdown does not narrow the activation context or provide exclusions, so the trigger remains vague under the documented criteria.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The runbook explicitly captures and persists the raw user query plus detailed CLI command history, which can include sensitive travel details, personal data, and operational metadata unrelated to the minimum functionality needed for car-rental booking. In a travel skill context, users may provide names, locations, dates, contact details, or document-related information, so retaining raw input and commands creates unnecessary privacy and data-exposure risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The runbook requires persistent logging of raw user input and command history but provides no user-facing warning or privacy notice about retention. Because this skill handles travel workflows that can involve personally sensitive itinerary and booking information, silent retention materially increases privacy and compliance risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The runbook instructs appending execution logs to a local file, creating a persistent data-retention mechanism that is not clearly necessary for the stated travel-booking purpose. Persistent local logs increase the chance of later disclosure through filesystem access, backups, log aggregation, or multi-tenant host exposure.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The runbook describes writing execution logs to the filesystem without any warning or transparency about local file writes. While the write itself is not inherently malicious, undisclosed persistence broadens the attack surface and can surprise operators in constrained or privacy-sensitive environments.
- Content
Static analysis
No suspicious patterns detected.